Hmbown/CodeWhale · error

the approval UI cannot persist deny rules

Error message

the approval UI cannot persist deny rules

What it means

Raised from the approval-UI persistence path (persist_rules_from_approval) when attempting to persist deny rules. The match on the rule action handles Ask and Allow rules by appending them to the config store, but deny rules have no persistent store representation from the approval dialog, so the request is rejected with this sentinel error rather than silently dropped.

Source

Thrown at crates/tui/src/tui/ui/session_state.rs:742

        }
    }
    app.needs_redraw = true;
}

pub(crate) fn persist_rules_from_approval(
    app: &mut App,
    config: &mut Config,
    rules: &[codewhale_config::ToolAskRule],
) {
    let action = rules.first().map(|rule| rule.action);
    match codewhale_config::ConfigStore::load(app.config_path.clone()).and_then(|mut store| {
        let added = match action {
            Some(codewhale_execpolicy::PermissionAction::Ask) => store.append_ask_rules(rules)?,
            Some(codewhale_execpolicy::PermissionAction::Allow) => {
                store.append_allow_rules(rules)?
            }
            Some(codewhale_execpolicy::PermissionAction::Deny) => {
                anyhow::bail!("the approval UI cannot persist deny rules")
            }
            None => 0,
        };
        let permissions_path = store.permissions_path();
        config.exec_policy_engine = store.exec_policy_engine();
        Ok((added, permissions_path))
    }) {
        Ok((added, path)) if added > 0 => {
            let action = match action {
                Some(codewhale_execpolicy::PermissionAction::Allow) => "allow",
                _ => "ask",
            };
            app.status_message = Some(format!(
                "Saved {added} {action} permission rule(s) to {}",
                path.display()
            ));
        }
        Ok((_added, path)) => {

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Add deny rules through the config file or execpolicy tooling that supports persisting denies
2. Use Ask or Allow actions in the approval UI if persistence is required
3. Treat an in-session deny from the approval UI as session-only by design

When it happens

Trigger: Thrown at crates/tui/src/tui/ui/session_state.rs:742 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/02e711a776bc7b15. Report an issue: GitHub.